CVE-2026-61121: Oracle HRMS UK Payroll RCE Vulnerability

CVE-2026-61121 Overview

CVE-2026-61121 is a high-severity vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite, specifically within the UK Payroll component. The flaw affects supported versions 12.2.8 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability to compromise Oracle HRMS (UK). Successful exploitation results in complete takeover of the application, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can achieve full takeover of Oracle HRMS (UK), exposing sensitive payroll data and enabling unauthorized modification of employee records.

Affected Products

Oracle E-Business Suite - Oracle HRMS (UK), UK Payroll component, version 12.2.8
Oracle E-Business Suite - Oracle HRMS (UK), UK Payroll component, versions 12.2.9 through 12.2.14
Oracle E-Business Suite - Oracle HRMS (UK), UK Payroll component, version 12.2.15

Discovery Timeline

2026-07-21 - CVE-2026-61121 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert - July 2026

Technical Details for CVE-2026-61121

Vulnerability Analysis

The vulnerability resides in the UK Payroll component of Oracle HRMS (UK), a module within Oracle E-Business Suite that processes payroll data for UK-based organizations. Oracle describes the issue as easily exploitable over the network via HTTP. An attacker only needs low-privileged access, meaning a standard authenticated E-Business Suite user account is sufficient. No user interaction is required, and exploitation does not require elevated permissions or complex conditions.

Successful exploitation grants the attacker takeover of Oracle HRMS (UK), producing high impact across all three security properties. Because UK Payroll processes salary data, national insurance numbers, tax codes, and bank details, the confidentiality impact is significant for affected organizations. The integrity impact allows tampering with payroll runs, deductions, or payment destinations.

Root Cause

Oracle has not published a detailed technical breakdown of the underlying flaw. Based on the CVSS metrics and the affected component, the vulnerability requires an authenticated HTTP session against the Oracle E-Business Suite application tier. Refer to the Oracle Security Alert - July 2026 for vendor-supplied technical details.

Attack Vector

The attack vector is network-based. An attacker with valid low-privileged credentials sends crafted HTTP requests to the Oracle E-Business Suite application tier hosting the UK Payroll module. Because the scope is unchanged, the attacker gains control only within the vulnerable component, but that control is sufficient to compromise all payroll data and workflows managed by Oracle HRMS (UK).

No verified public proof-of-concept code is available. Describing exploitation in prose rather than synthetic code preserves technical accuracy.

Detection Methods for CVE-2026-61121

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite UK Payroll endpoints originating from low-privileged user accounts
Anomalous payroll record modifications, especially changes to bank account details, tax codes, or salary values outside of scheduled payroll runs
New or modified concurrent programs, requests, or database triggers within HRMS schemas that were not introduced through change control
Authentication events for service or generic accounts accessing UK Payroll functions outside normal business hours

Detection Strategies

Enable and centralize Oracle E-Business Suite application-tier and database audit logs, focusing on the HR and PAY schemas used by UK Payroll
Correlate low-privileged user sessions with administrative-level actions in HRMS, which indicates possible privilege escalation post-exploitation
Baseline normal HTTP request patterns to Oracle E-Business Suite and alert on deviations targeting UK Payroll servlet and JSP endpoints

Monitoring Recommendations

Ingest Oracle E-Business Suite web server, application, and database audit logs into a centralized analytics platform for correlation
Monitor outbound network activity from the Oracle E-Business Suite application tier for signs of data exfiltration following suspicious HTTP requests
Track patch level and version information across all Oracle E-Business Suite instances to identify systems still exposed to CVE-2026-61121

How to Mitigate CVE-2026-61121

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running versions 12.2.8 through 12.2.15
Inventory all Oracle HRMS (UK) deployments and confirm patch status against the fixes listed in the Oracle advisory
Restrict network access to the Oracle E-Business Suite application tier to trusted corporate networks and VPN ranges
Review recent authentication and payroll transaction logs for signs of exploitation before patching

Patch Information

Oracle released a fix in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert - July 2026 and apply the vendor-supplied patches for Oracle E-Business Suite versions 12.2.8 through 12.2.15. Oracle typically does not provide standalone patches outside of the quarterly Critical Patch Update, so administrators should plan patch cycles accordingly.

Workarounds

Reduce the population of accounts with access to UK Payroll functions to the minimum required for business operations
Enforce multi-factor authentication for all Oracle E-Business Suite accounts, particularly those with HRMS responsibilities
Place a web application firewall in front of the Oracle E-Business Suite application tier and restrict access to UK Payroll URIs to authorized IP ranges
Enable enhanced auditing on HR and PAY schemas until the patch can be applied